The situation:
An app uses `jose` 5.9.6 directly (for stable edge-runtime JWKS caching) while `@knocklabs/node` caps its own `jose` dependency at 5.2.0. Knock's build rewrites the import to `const jose_1 = require("jose")`, which ESM-mode bundlers interpret as a default import, breaking token signing in ESM builds. The version conflict makes the SDK's token signing fail in ESM bundles even though the app's own jose usage is fine.
What actually fixes it (verified in the thread):
The `jose` version conflict was resolved when @knocklabs/node 1.x dropped the `jose` dependency entirely. Upgrade to the 1.x release line to remove the conflict. Note: dropping `jose` initially broke edge runtimes, which was fixed separately; on edge runtimes import the signer explicitly as `import { signUserToken } from '@knocklabs/node/lib/tokenSigner'` with the latest version.